AgentStack
Sign in Publish
MCP servers Skills Toolkits Why AgentStack Sell Docs
Sign in
SKILL verified MIT Self-run

Hermes Deploy Guard

skill-davidgut1982-hermes-toolkit-hermes-deploy-guard · by davidgut1982

>-

↗ Repository
— No reviews yet
0 installs
5 views
0.0% view→install

Install

$ agentstack add skill-davidgut1982-hermes-toolkit-hermes-deploy-guard

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • ✓ Prompt-injection patterns
  • ✓ Secret / credential exfiltration
  • ✓ Dangerous shell & filesystem operations
  • ✓ Untrusted network calls
  • ✓ Known-malicious package signatures

What it can access

  • ✓ Network access No
  • ✓ Filesystem access No
  • ✓ Shell / process execution No
  • ✓ Environment & secrets No
  • ✓ Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

Are you the author of Hermes Deploy Guard? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

Hermes Deploy Guard

A Hermes editable install has no build step: the checked-out git branch is the running code. This skill is the invariant that keeps that safe and the exact recovery when it breaks. (Background: hermes-internals → "Homelab deployment realities".)

The invariant

  • Live checkout: /opt/hermes/home/.hermes/hermes-agent.
  • It MUST stay on branch integrated (carries profile-aware delegation).
  • Never git checkout a feature branch on the live tree. Two prior outages

came from exactly that. Dev work goes in a git worktree or hermes -p dev.

Two config files (fix both)

| File | Read by | |---|---| | /opt/hermes/home/config.yaml | gateway (Telegram / messaging) | | /opt/hermes/home/.hermes/config.yaml | TUI / CLI (HERMES_HOME=/opt/hermes/home/.hermes) |

A config change in one only silently fails on the other surface.

Health checks

# 1. branch integrity — must print: integrated
git -C /opt/hermes/home/.hermes/hermes-agent rev-parse --abbrev-ref HEAD

# 2. PID/lock symlinks (required after a dashboard restart)
ls -l /opt/hermes/home/.hermes/gateway.pid /opt/hermes/home/.hermes/gateway.lock
#    -> should point at /opt/hermes/home/gateway.{pid,lock}

Ops/service checks go through the cluster-ops MCP (service_status, disk_usage, journal_tail, …) — terminal/code_execution are disabled on this build.

Recovery (run in order, only when drift/breakage is confirmed)

cd /opt/hermes/home/.hermes/hermes-agent
git checkout integrated                                   # restore running branch (the ONE allowed checkout)
pip install -e .                                          # re-link editable install
# restart the gateway (dashboard, or `hermes gateway stop --all` then start)
ln -sf /opt/hermes/home/gateway.pid  /opt/hermes/home/.hermes/gateway.pid    # recreate symlinks
ln -sf /opt/hermes/home/gateway.lock /opt/hermes/home/.hermes/gateway.lock
# verify end-to-end (Woodstock IL weather + chat should go green):
python ../hermes-eval-harness/scripts/hermes_eval.py \
  --suite ../hermes-eval-harness/scripts/suites/smoke.yaml --backend library --workers 4

Verification

Done = branch is integrated, both config files agree, both symlinks resolve to /opt/hermes/home/gateway.*, and the smoke suite passes weather + chat. Report the raw outputs, not a "looks healthy" claim.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Write a review

Versions

  • v0.1.0 Imported from the upstream source.

More in Agent Skills